A card test link is a page, script, or payment endpoint that someone uses to check whether a stolen card number still works. The operator sends card data through it, reads the approve or decline response, and keeps the numbers that pass. On a merchant's side, the same traffic appears as a burst of small authorization attempts against the checkout.
How does a card test link work?
Card testing runs on volume. An attacker loads a list of numbers into a bot, points it at a checkout or payment form, and submits hundreds of orders in minutes. Each attempt returns a yes or no from the processor, and the live cards get pulled out for resale or spending.
Automated tools handle the loop. Some use stolen merchant accounts or donation pages, which keeps the fraud away from their own accounts. Others rotate IP addresses, device fingerprints, and card numbers to slip past per-card limits.
What does card testing look like in your logs?
The pattern matters more than any single transaction. Card testing produces clusters: one device, many cards, or one card across many accounts inside a short window.
- Order values from $0.01 to $1.00, chosen to avoid manual review.
- Waves of declines from the same IP range or device ID.
- Many card numbers tried against one email address or account.
- Traffic spikes at 2 a.m. with no matching ad spend.
- Decline codes such as "do not honor" and "invalid card number" arriving in bulk.
How much does card testing cost a merchant?
Every test attempt reaches the card network as an authorization request, successful or not. Processors bill for those requests, so one attack can add hundreds of dollars in fees before a single real sale lands.
Successful tests turn into chargebacks. The cardholder bought nothing, so the bank reverses the charge and adds a dispute fee, which runs from $15 to $100 per case at major processors.
Card brands watch fraud and dispute ratios. A merchant that stays on a high-fraud list can lose card acceptance for the whole account, not just the payment page that got hit.
Does card testing hit small stores?
Small stores take the same hits as large ones. Fraud crews scan for weak checkout setups, and a store with no velocity rules is an easy target. One attack on a small shop can erase a month of margin in fees and disputes.
Steps to stop card testing on your site
- Set a floor on order value. Block or review orders under $1 if your catalog does not include items that cheap.
- Add velocity rules. Cap attempts per IP, per card, per email, and per device in a rolling 10-minute window.
- Require CVV and address verification. Attackers often hold card numbers without the security code or billing ZIP, so a mismatch becomes a signal.
- Put a bot check on checkout and account creation. CAPTCHA and JavaScript challenges raise the cost of running thousands of attempts.
- Throttle data center IP ranges and known proxy services.
- Review authorization logs each day for spikes in decline volume.
- Alert on unusual approval rates. A jump in small approvals points to a card that worked.
How do you set limits without blocking real customers?
Start at the low end. A rule that blocks three attempts from one device in ten minutes catches most bot traffic and rarely touches a real shopper. Watch the false-positive rate for a week, then tighten.
Segment the rules. Guest checkout needs tighter limits than a logged-in account with purchase history, and new accounts deserve more scrutiny than repeat buyers.
Which numbers belong on a fraud dashboard?
Track four: authorization attempts per minute, decline rate by BIN, unique cards per IP, and average order value. A card test attack moves all four at once, while normal traffic moves them one at a time.
Keep authorization records for at least 90 days. Chargebacks arrive weeks after the test run, and you need the original data to contest them.
Can a merchant recover money lost to card testing?
In most cases, no. Processors do not refund authorization fees, and chargeback fees are yours. A few fraud vendors credit fees when an attack slips past their filters, so read that clause before signing a contract.
Dispute outcomes improve with evidence. Submit device ID, IP address, AVS and CVV results, and the timing pattern of the test run. Banks accept those packets more often than a bare claim of fraud.
Is selling CVV data legal?
No. Buying or selling card numbers, security codes, or full card data is a federal crime in the United States under 18 U.S.C. 1029, with similar statutes in most other countries. A card test link exists to confirm that stolen data is usable, which is why the tool sits inside the carding market rather than in legitimate payment work.
Merchants need the opposite of that tooling: logging, rate limits, and fraud rules that react to patterns. The defense holds whether the attacker runs one script or a farm of bots.
FAQ
Does a card test link need a real checkout page?
No. Operators point the same tools at donation forms, subscription signups, and stored-card features. Any endpoint that returns an approve or decline result does the job.
How long does a card testing attack last?
Most run for minutes to a few hours. Long attacks come from botnets that rotate identity, which is why per-IP limits alone fail.
Do 3D Secure checks stop card testing?
They cut it down. A step-up challenge blocks most automated attempts because bots cannot complete the bank prompt. Added friction can lower conversion, so measure the tradeoff on your own traffic.
Is card testing the same as a BIN attack?
A BIN attack targets one bank identification number and generates numbers that fit its pattern. Card testing puts those generated numbers through a payment page. The same crews run both, so the terms overlap.
What is the fastest fix for a live attack?
Block the offending IP range, raise the order minimum, and turn on a strict fraud rule for small-value orders. That buys time while you tune the permanent limits.